Restrict Shared VPC Subnetworks
More Info:
Ensure that “Restrict Shared VPC Subnetworks” policy is enforced for your GCP organizations.Risk Level
MediumAddress
Security, Operational MaturityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Restrict Shared VPC Subnetworks” misconfiguration in GCP using GCP console, you can follow these steps:
- Open the GCP console and go to the VPC network page.
- Select the shared VPC network for which you want to restrict subnetworks.
- In the “Subnetworks” section, click on the “Edit” button.
- In the “Subnetworks” dialog box, uncheck the “Allow new subnetworks in this VPC network” option.
- Click on the “Save” button to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration of “Restrict Shared VPC Subnetworks” in GCP using GCP CLI, you can follow the below steps:Step 1: Open the Cloud ShellStep 2: Run the below command to list all the subnetworks in the shared VPC:Note: Replace [SHARED_VPC_NAME] and [HOST_PROJECT_ID] with the actual shared VPC name and host project ID.Step 3: Run the below command to restrict the subnetworks in the shared VPC:Note: Replace [SHARED_VPC_NAME] and [HOST_PROJECT_ID] with the actual shared VPC name and host project ID.This command will disable all the shared VPC features which can be enabled on subnetworks.Step 4: Run the below command to verify the changes:Note: Replace [SHARED_VPC_NAME] and [HOST_PROJECT_ID] with the actual shared VPC name and host project ID.This command will display the details of the shared VPC and confirm that the subnetworks are restricted.By following these steps, you can remediate the misconfiguration of “Restrict Shared VPC Subnetworks” in GCP using GCP CLI.
Using Python
Using Python
To remediate the misconfiguration of “Restrict Shared VPC Subnetworks” for GCP using Python, follow the below steps:This code will set the “private_ip_google_access” property of the subnetwork to “false”, which will restrict shared VPC subnetworks.Note: Make sure to replace the “path/to/service_account_key.json”, “your_project_id”, and “your_subnetwork_name” with the actual values.
- First, you need to create a service account and download the JSON key for authentication.
- Install the Google Cloud SDK and the necessary Python libraries.
- Use the following Python code to remediate the misconfiguration: